CVE-2018-9104: XSS
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the api.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mitel MiVoice Connect (conferencing component)to a version that resolves this vulnerability.Fixed in R1707-PREM SP1 (21.84.5535.0) - Upgrade
Upgrade
Mitel ST 14.2to a version that resolves this vulnerability.Fixed in GA27 (19.49.5200.0) - Compensating control
Mitigate reflected XSS against api.php in Mitel MiVoice Connect (conferencing component) versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2 versions GA27 (19.49.5200.0) and earlier, by adding an external web application firewall (WAF) rule set that blocks reflected XSS payloads targeting the /api.php endpoint from unauthenticated requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-9104?
The severity of CVE-2018-9104 is medium with a CVSS score of 6.1.
How does CVE-2018-9104 affect Mitel MiVoice Connect?
CVE-2018-9104 affects Mitel MiVoice Connect versions R1707-PREM SP1 (21.8.5535.0) and earlier by allowing an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack.
How does CVE-2018-9104 affect Mitel ST 14.2?
CVE-2018-9104 affects Mitel ST 14.2 versions GA27 (19.49.5200.0) and earlier by allowing an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack.
What is the CVE ID of the vulnerability in Mitel MiVoice Connect?
The CVE ID of the vulnerability in Mitel MiVoice Connect is CVE-2018-9104.
What is the CVE ID of the vulnerability in Mitel ST 14.2?
The CVE ID of the vulnerability in Mitel ST 14.2 is CVE-2018-9104.